I am new to Autopsy and seeking some assistance. I am using version 4.19.3 64bit on a Windows 11 operating system. I am having issues with “Extract Files” functionality.
While in “Listing” view, I right-click on the file of interest. I select “Extract File(s).
I then select the location for the selected file to be saved.
Upon saving, I get a dialog message "File(s) Extracted
When reviewing the files in the Export folder, all export files reflect 0 KB file size. The TXT and HTML files opens yet shows no content. The PDF and XLS files error out when attempting to open.
I have Googled this issue with limited hits and nothing “on point”. I suspect “user error” and seeking guidance.
Do the files you’re trying to export show a non-zero file size in the “Size” column in the result viewer?
Can you view their data on the hex tab?
If all that looks good, try to export again and then look for errors in the log file.
http://sleuthkit.org/autopsy/docs/user-docs/4.19.3/troubleshooting_page.html#troubleshooting_logs
Continuing the discussion from Extract results in 0 KB file size for exported files. :
I do see the size in the “Size” column
In Hex view I get this. Not what I would expect.
When I view the Export folder on my PC, I see the correct file names with 0 KB size.
I will look at the log file but do to the fact that the Hex view shows “(offset 0-16,384 could not be read)”, I suspect something else is the issue.
Sorry…this is what I get in Hex view.
Here is the Log entry when attempting to do a Extract.
My C drive has the operating system (Windows 11) and the Autopsy application.
My D drive has the Case file and all other associated folders/files.
My C drive is encrypted. My D drive is not encrypted.
Is my encrypted C drive the issue?
2022-08-25 15:49:48.713 org.sleuthkit.autopsy.datamodel.ContentUtils$ExtractFscContentVisitor visit
WARNING: Error reading file ‘2021 12 24 - Payroll Timesheets CTB.xlsx’ (id=322261).
org.sleuthkit.datamodel.ReadContentInputStream$ReadContentInputStreamException: Error reading file ‘2021 12 24 - Payroll Timesheets CTB.xlsx’ (id=322261) at offset 0.
org.sleuthkit.datamodel.ReadContentInputStream.read(ReadContentInputStream.java:105)
org.sleuthkit.datamodel.ReadContentInputStream.read(ReadContentInputStream.java:47)
org.sleuthkit.autopsy.datamodel.ContentUtils.writeToFile(ContentUtils.java:211)
org.sleuthkit.autopsy.datamodel.ContentUtils$ExtractFscContentVisitor.visit(ContentUtils.java:399)
org.sleuthkit.autopsy.datamodel.ContentUtils$ExtractFscContentVisitor.visit(ContentUtils.java:357)
org.sleuthkit.datamodel.File.accept(File.java:128)
org.sleuthkit.autopsy.datamodel.ContentUtils$ExtractFscContentVisitor.extract(ContentUtils.java:393)
org.sleuthkit.autopsy.directorytree.actionhelpers.ExtractActionHelper$FileExtracter.doInBackground(ExtractActionHelper.java:325)
javax.swing.SwingWorker$1.call(SwingWorker.java:295)
java.util.concurrent.FutureTask.run(FutureTask.java:266)
javax.swing.SwingWorker.run(SwingWorker.java:334)
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
java.lang.Thread.run(Thread.java:748)
org.sleuthkit.datamodel.TskCoreException: Possible encryption detected (High entropy (8.00))
org.sleuthkit.datamodel.ReadContentInputStream.read(ReadContentInputStream.java:105)
org.sleuthkit.datamodel.ReadContentInputStream.read(ReadContentInputStream.java:47)
org.sleuthkit.autopsy.datamodel.ContentUtils.writeToFile(ContentUtils.java:211)
org.sleuthkit.autopsy.datamodel.ContentUtils$ExtractFscContentVisitor.visit(ContentUtils.java:399)
org.sleuthkit.autopsy.datamodel.ContentUtils$ExtractFscContentVisitor.visit(ContentUtils.java:357)
org.sleuthkit.datamodel.File.accept(File.java:128)
org.sleuthkit.autopsy.datamodel.ContentUtils$ExtractFscContentVisitor.extract(ContentUtils.java:393)
org.sleuthkit.autopsy.directorytree.actionhelpers.ExtractActionHelper$FileExtracter.doInBackground(ExtractActionHelper.java:325)
javax.swing.SwingWorker$1.call(SwingWorker.java:295)
java.util.concurrent.FutureTask.run(FutureTask.java:266)
javax.swing.SwingWorker.run(SwingWorker.java:334)
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
java.lang.Thread.run(Thread.java:748)
Just curious is this datasource an image file and if so have you hashed the data source integrity module to make sure it is not corrupted?
I was given an “image file” (Image.E01 to image.EEM). Autopsy reads the image file with no issues or errors. I have searched the image file using Keywords and have receive hits that I suspected would be there. When trying to extract the files with these hits, is when I obtain an extracted file with 0 bytes.
I have removed encryption from the C drive but am getting the same results when trying to Extract a file. Still 0 bytes.
